REITs may find complying with the Sarbanes-Oxley Act (SOX) easier since the U.S. Securities and Exchange Commission voted unanimously May 23 to ease some of its more restrictive requirements. One day after the SEC's action, the Public Company Accounting Oversight Board, which oversees outside corporate auditors, also eased its standards to match the SEC's new guidance.

That new guidance comes after years of complaints that SOX compliance cost corporations, especially smaller companies, too much time and money. But now that many corporations have already absorbed the initial burden of creating systems to comply with SOX, are the new rules too little too late?

Long-sought changes

SOX was signed into law in 2002 to rebuild investor confidence in the stock market after accounting scandals at corporate giants such as Enron and WorldCom. It requires publicly traded companies, including REITs, to comply with tough auditing requirements on internal financial controls.

The SOX pill, however, has been hard for some corporations to swallow. Many complained that SOX Section 404 forced them to engage in reporting on the minutiae of internal financial controls, which wasted time and money.

For instance, auditors sometimes zeroed in on what many called “check the box” functions, such as whether everyday invoices had a particular number of signatures.

That highly detailed focus increased the cost of complying with SOX, says Dale Anne Reiss, Ernst & Young's global and Americas director of real estate, hospitality, gaming, and construction in New York. Reiss estimates that in the first several years after SOX was implemented, compliance cost 3 to 5 cents per share, regardless of company size. The compliance burden fell disproportionately on smaller companies. As compliance has become routine, says Reiss, those costs have gone down but not disappeared.

“To a great extent, the new SEC rule and the new auditing standard by the Public Company Accounting Oversight Board deliver what we've hoped,” says George Yungmann, senior vice president of financial standards at the National Association of Real Estate Investment Trusts based in Washington, D.C.

The new rules allow companies to conduct a top-down, risk-based analysis of their internal controls, says Yungmann, rather than getting into a hyper-detailed review. “It brings us up out of the weeds,” he says, “and the new rules are intended to be scalable for companies.”

Each company will be allowed to determine which areas present the greatest risk for making material errors in financial statements and implement controls for those risks.

“That will leave more discretion to the company in determining how those systems should be in place and how they should be evaluated — and that's good,” says Reiss.

Too late to matter?

Still, questions remain. Are the changes too late to lessen the financial burdens on companies already in compliance? And will they ease auditing in practice, not just in the rulebooks?

“We expect a reduction in the amount of time and cost associated with SOX compliance,” says Bob McCadden, executive vice president and chief financial officer of Pennsylvania Real Estate Investment Trust in Philadelphia, which invests in regional malls and power shopping centers. McCadden's staff has been meeting with auditors to determine changes the company will make; he expects to have changes in place by the end of 2007.

“We generally have good top-down level controls,” says McCadden, “and we expect these changes to give us more latitude in relying more on those instead of transaction-level controls. You don't have to look at every invoice, but you look at whether financial results are in line with our own expectations and budgets.”

Reiss of Ernst & Young says it may be a little too late for cost savings at most companies. “With the big, established REITs, everybody's already settled in — good, bad, or indifferent. Everything's in place, and it's integrated into the basic operations of most companies.”

NAREIT's Yungmann says the new rules may make compliance less costly for the smallest REITs, which haven't begun compliance yet. Companies with market capitalization of less than $75 million had been exempt while the SEC considered the impact of the rules on those companies. But the new rules require even those companies to comply by Dec. 15, 2007.

And will the changes actually make it into practice? Yungmann is adopting a wait-and-see attitude. “We think it's very important that the Public Company Accounting Oversight Board's reviewers actually audit in a manner that's consistent with the new auditing standard,” says Yungmann. “If they don't — if they're still going to look for a lot of detail — these changes won't work.”

G.M. Filisko is a reporter and attorney based in Chicago who writes regularly on legal and real estate issues. She can be contacted at gabifil@rcn.com.